stream: fix decoded fromList chunk boundary check by watson · Pull Request #61884 · nodejs/node

watson · 2026-02-19T10:28:10Z

Correct fromList() in decoded string mode to compare n against the current chunk length, not the buffer array length.

This prevents over-consuming chunks, which can corrupt readable state and crash with TypeError when mixing setEncoding() and read(n).

I reproduced this in all non-EoL release lines.

For reference, here's the script I used to make read() throw (usually it throws almost instantly, but a few times it can take a little while):

'use strict'

const https = require('node:https')

const url = process.argv[2] || 'https://www.google.com'
const maxRuns = Number(process.argv[3] || 2000)
let runs = 0

function runOnce () {
  runs++
  https.get(url, (res) => {
    res.setEncoding('utf8') // If this line is removed, the crash doesn't happen.

    res.on('readable', () => {
      // Race condition: The call to `res.read(100)` might throw
      while (res.read(100) !== null) {}
    })

    res.on('end', () => {
      if (runs >= maxRuns) {
        console.log(`completed ${runs} runs without crash`)
      } else {
        runOnce()
      }
    })
  })
}

console.log(`reproducing with ${url} for up to ${maxRuns} runs...`)
runOnce()

And here's the output:

reproducing with https://www.google.com for up to 2000 runs...
node:internal/streams/readable:1650
  } else if (n < buf[idx].length) {
                          ^

TypeError: Cannot read properties of undefined (reading 'length')
    at fromList (node:internal/streams/readable:1650:27)
    at Readable.read (node:internal/streams/readable:756:11)
    at IncomingMessage.<anonymous> (/Users/thomas.watson/go/src/github.com/DataDog/dd-trace-js/foo.js:16:18)
    at IncomingMessage.emit (node:events:508:20)
    at emitReadable_ (node:internal/streams/readable:837:12)
    at process.processTicksAndRejections (node:internal/process/task_queues:89:21)

Node.js v25.6.1

nodejs-github-bot · 2026-02-19T10:28:14Z

Review requested:

@nodejs/streams

Correct `fromList()` in decoded string mode to compare `n` against the current chunk length, not the buffer array length. This prevents over-consuming chunks, which can corrupt readable state and crash with `TypeError` when mixing `setEncoding()` and `read(n)`.

nodejs-github-bot · 2026-02-19T11:05:46Z

CI: https://ci.nodejs.org/job/node-test-pull-request/71377/

codecov · 2026-02-19T11:44:56Z

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 89.73%. Comparing base (d5279e5) to head (2984f13).
⚠️ Report is 19 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/internal/streams/readable.js	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #61884      +/-   ##
==========================================
- Coverage   91.81%   89.73%   -2.08%     
==========================================
  Files         338      675     +337     
  Lines      140073   204855   +64782     
  Branches    22081    39372   +17291     
==========================================
+ Hits       128605   183829   +55224     
- Misses      11242    13287    +2045     
- Partials      226     7739    +7513

Files with missing lines	Coverage Δ
lib/internal/streams/readable.js	`97.16% <0.00%> (+0.88%)`	⬆️

... and 456 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

mcollina

lgtm

nodejs-github-bot · 2026-02-21T10:37:07Z

Commit Queue failed

- Loading data for nodejs/node/pull/61884 ✔ Done loading data for nodejs/node/pull/61884 ----------------------------------- PR info ------------------------------------ Title stream: fix decoded fromList chunk boundary check (#61884) Author Thomas Watson <w@tson.dk> (@watson) Branch watson:fix-readable-stream-bug -> nodejs:main Labels stream, author ready, needs-ci Commits 2 - stream: fix decoded fromList chunk boundary check - fix lint Committers 1 - Thomas Watson <w@tson.dk> PR-URL: https://github.com/nodejs/node/pull/61884 Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Minwoo Jung <nodecorelab@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> ------------------------------ Generated metadata ------------------------------ PR-URL: https://github.com/nodejs/node/pull/61884 Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Minwoo Jung <nodecorelab@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> -------------------------------------------------------------------------------- ℹ This PR was created on Thu, 19 Feb 2026 10:28:10 GMT ✔ Approvals: 9 ✔ - Robert Nagy (@ronag) (TSC): https://github.com/nodejs/node/pull/61884#pullrequestreview-3824865677 ✔ - Ruben Bridgewater (@BridgeAR) (TSC): https://github.com/nodejs/node/pull/61884#pullrequestreview-3824921277 ✔ - Ilyas Shabi (@IlyasShabi): https://github.com/nodejs/node/pull/61884#pullrequestreview-3825273620 ✔ - Gürgün Dayıoğlu (@gurgunday): https://github.com/nodejs/node/pull/61884#pullrequestreview-3825732569 ✔ - Luigi Pinca (@lpinca): https://github.com/nodejs/node/pull/61884#pullrequestreview-3828304463 ✔ - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/61884#pullrequestreview-3828525776 ✔ - Minwoo Jung (@JungMinu): https://github.com/nodejs/node/pull/61884#pullrequestreview-3830500467 ✔ - Colin Ihrig (@cjihrig): https://github.com/nodejs/node/pull/61884#pullrequestreview-3832438069 ✔ - Ethan Arrowood (@Ethan-Arrowood): https://github.com/nodejs/node/pull/61884#pullrequestreview-3832584001 ✔ Last GitHub CI successful ℹ Last Full PR CI on 2026-02-19T11:05:46Z: https://ci.nodejs.org/job/node-test-pull-request/71377/ - Querying data for job/node-test-pull-request/71377/ ✔ Build data downloaded ✔ Last Jenkins CI successful -------------------------------------------------------------------------------- ✔ No git cherry-pick in progress ✔ No git am in progress ✔ No git rebase in progress -------------------------------------------------------------------------------- - Bringing origin/main up to date... From https://github.com/nodejs/node * branch main -> FETCH_HEAD ✔ origin/main is now up-to-date - Downloading patch for 61884 From https://github.com/nodejs/node * branch refs/pull/61884/merge -> FETCH_HEAD ✔ Fetched commits as 94df36a12199..2984f1316238 -------------------------------------------------------------------------------- [main 555cb3c22c] stream: fix decoded fromList chunk boundary check Author: Thomas Watson <w@tson.dk> Date: Thu Feb 19 11:25:19 2026 +0100 2 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 test/parallel/test-stream2-read-correct-num-bytes-in-utf8.js [main 78184b3a60] fix lint Author: Thomas Watson <w@tson.dk> Date: Thu Feb 19 11:43:24 2026 +0100 1 file changed, 1 insertion(+) ✔ Patches applied There are 2 commits in the PR. Attempting autorebase. (node:458) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated. (Use `node --trace-deprecation ...` to show where the warning was created) Rebasing (2/4) Executing: git node land --amend --yes --------------------------------- New Message ---------------------------------- stream: fix decoded fromList chunk boundary check

Correct fromList() in decoded string mode to compare n against the
current chunk length, not the buffer array length.

This prevents over-consuming chunks, which can corrupt readable state
and crash with TypeError when mixing setEncoding() and read(n).

PR-URL: #61884
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

[detached HEAD ca615c81bd] stream: fix decoded fromList chunk boundary check
Author: Thomas Watson <w@tson.dk>
Date: Thu Feb 19 11:25:19 2026 +0100
2 files changed, 16 insertions(+), 1 deletion(-)
create mode 100644 test/parallel/test-stream2-read-correct-num-bytes-in-utf8.js
Rebasing (3/4)
Rebasing (4/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
fix lint

PR-URL: #61884
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

[detached HEAD 403f5bd46a] fix lint
Author: Thomas Watson <w@tson.dk>
Date: Thu Feb 19 11:43:24 2026 +0100
1 file changed, 1 insertion(+)
Successfully rebased and updated refs/heads/main.

ℹ Add commit-queue-squash label to land the PR as one commit, or commit-queue-rebase to land as separate commits.

https://github.com/nodejs/node/actions/runs/22255290326

nodejs-github-bot · 2026-02-22T00:19:42Z

Landed in d10104b

Correct `fromList()` in decoded string mode to compare `n` against the current chunk length, not the buffer array length. This prevents over-consuming chunks, which can corrupt readable state and crash with `TypeError` when mixing `setEncoding()` and `read(n)`. PR-URL: #61884 Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Minwoo Jung <nodecorelab@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `25.6.1` → `25.7.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v25.7.0`](https://github.com/nodejs/node/releases/tag/v25.7.0): 2026-02-24, Version 25.7.0 (Current), @ruyadorno prepared by @aduh95 [Compare Source](nodejs/node@v25.6.1...v25.7.0) ##### Notable Changes - \[[`b0a79b10f0`](nodejs/node@b0a79b10f0)] - **(SEMVER-MINOR)** **http2**: add http1Options for HTTP/1 fallback configuration (Amol Yadav) [#61713](nodejs/node#61713) - \[[`2d874dfb8e`](nodejs/node@2d874dfb8e)] - **(SEMVER-MINOR)** **sea**: support ESM entry point in SEA (Joyee Cheung) [#61813](nodejs/node#61813) - \[[`ee59127664`](nodejs/node@ee59127664)] - **sqlite**: mark as release candidate (Matteo Collina) [#61262](nodejs/node#61262) - \[[`608736e19e`](nodejs/node@608736e19e)] - **(SEMVER-MINOR)** **stream**: rename `Duplex.toWeb()` type option to `readableType` (René) [#61632](nodejs/node#61632) - \[[`a43375999f`](nodejs/node@a43375999f)] - **(SEMVER-MINOR)** **test\_runner**: show interrupted test on SIGINT (Matteo Collina) [#61676](nodejs/node#61676) ##### Commits - \[[`ab4375e141`](nodejs/node@ab4375e141)] - **benchmark**: add startup benchmark for ESM entrypoint (Joyee Cheung) [#61769](nodejs/node#61769) - \[[`8d83d8026b`](nodejs/node@8d83d8026b)] - **build**: add temporal test on GHA windows (Chengzhong Wu) [#61810](nodejs/node#61810) - \[[`aab153eec3`](nodejs/node@aab153eec3)] - **build**: skip sscache action on non-main branches (Joyee Cheung) [#61790](nodejs/node#61790) - \[[`9e40fb93bc`](nodejs/node@9e40fb93bc)] - **build**: use path-ignore in GHA coverage-windows.yml (Chengzhong Wu) [#61811](nodejs/node#61811) - \[[`4896653361`](nodejs/node@4896653361)] - **build**: generate\_config\_gypi.py generates valid JSON (Shelley Vohr) [#61791](nodejs/node#61791) - \[[`bb82b44de0`](nodejs/node@bb82b44de0)] - **build**: build with v8 gdbjit support on supported platform (Joyee Cheung) [#61010](nodejs/node#61010) - \[[`e7173a093a`](nodejs/node@e7173a093a)] - **build**: show cc outputs when version detection failed (Chengzhong Wu) [#61700](nodejs/node#61700) - \[[`848050d38f`](nodejs/node@848050d38f)] - **build,win**: add WinGet Visual Studio 2022 Build Tools Edition config (Mike McCready) [#61652](nodejs/node#61652) - \[[`938841e1cd`](nodejs/node@938841e1cd)] - **crypto**: always return certificate serial numbers as uppercase (Anna Henningsen) [#61752](nodejs/node#61752) - \[[`dba9001d6f`](nodejs/node@dba9001d6f)] - **deps**: upgrade npm to 11.10.1 (npm team) [#61892](nodejs/node#61892) - \[[`75c8e18d2f`](nodejs/node@75c8e18d2f)] - **deps**: update nbytes to 0.1.3 (Node.js GitHub Bot) [#61879](nodejs/node#61879) - \[[`4ca1597f25`](nodejs/node@4ca1597f25)] - **deps**: remove stale OpenSSL arch configs (René) [#61834](nodejs/node#61834) - \[[`c4f298c729`](nodejs/node@c4f298c729)] - **deps**: update llhttp to 9.3.1 (Node.js GitHub Bot) [#61827](nodejs/node#61827) - \[[`7d63a2df93`](nodejs/node@7d63a2df93)] - **deps**: V8: cherry-pick [`64b36b4`](nodejs/node@64b36b441179) (Rafael Magrin) [#61712](nodejs/node#61712) - \[[`241a6b7088`](nodejs/node@241a6b7088)] - **deps**: update googletest to [`5a9c3f9`](nodejs/node@5a9c3f9) (Node.js GitHub Bot) [#61731](nodejs/node#61731) - \[[`eec896c0e0`](nodejs/node@eec896c0e0)] - **deps**: V8: backport [`6a0a25a`](nodejs/node@6a0a25abaed3) (Vivian Wang) [#61666](nodejs/node#61666) - \[[`5a9874af09`](nodejs/node@5a9874af09)] - **doc**: clarify status of feature request issues (Antoine du Hamel) [#61505](nodejs/node#61505) - \[[`0648ac64aa`](nodejs/node@0648ac64aa)] - **doc**: add esm and cjs examples to node:vm (Alfredo González) [#61498](nodejs/node#61498) - \[[`8b38718294`](nodejs/node@8b38718294)] - **doc**: clarify build environment is trusted in threat model (Matteo Collina) [#61865](nodejs/node#61865) - \[[`10e86818ee`](nodejs/node@10e86818ee)] - **doc**: remove incorrect mention of `module` in `typescript.md` (Rob Palmer) [#61839](nodejs/node#61839) - \[[`b50376f527`](nodejs/node@b50376f527)] - **doc**: simplify addAbortListener example (Chemi Atlow) [#61842](nodejs/node#61842) - \[[`dea0e7a856`](nodejs/node@dea0e7a856)] - **doc**: fix typo in --disable-wasm-trap-handler description (Dmytro Semchuk) [#61820](nodejs/node#61820) - \[[`57ac1f5aa0`](nodejs/node@57ac1f5aa0)] - **doc**: clean up globals.md (René) [#61822](nodejs/node#61822) - \[[`4c30d2bb4d`](nodejs/node@4c30d2bb4d)] - **doc**: remove obsolete Boxstarter automated install (Mike McCready) [#61785](nodejs/node#61785) - \[[`db610b9e32`](nodejs/node@db610b9e32)] - **doc**: clarify async caveats for `events.once()` (René) [#61572](nodejs/node#61572) - \[[`b4a826b11c`](nodejs/node@b4a826b11c)] - **doc**: update Juan's security steward info (Juan José) [#61754](nodejs/node#61754) - \[[`7d9cc5dc54`](nodejs/node@7d9cc5dc54)] - **doc**: fix methods being documented as properties in `process.md` (Antoine du Hamel) [#61765](nodejs/node#61765) - \[[`aa0362c26a`](nodejs/node@aa0362c26a)] - **doc**: add riscv64 info into platform list (Lu Yahan) [#42251](nodejs/node#42251) - \[[`9b0101b65b`](nodejs/node@9b0101b65b)] - **doc**: fix dropdown menu being obscured at <600px due to stacking context (Jeff) [#61735](nodejs/node#61735) - \[[`df2c65b3e4`](nodejs/node@df2c65b3e4)] - **doc**: fix spacing in process message event (Aviv Keller) [#61756](nodejs/node#61756) - \[[`01018559f5`](nodejs/node@01018559f5)] - **doc**: move describe/it aliases section before expectFailure (Luca Raveri) [#61567](nodejs/node#61567) - \[[`49443583af`](nodejs/node@49443583af)] - **doc**: fix broken links of net.md (YuSheng Chen) [#61673](nodejs/node#61673) - \[[`af7c927a2a`](nodejs/node@af7c927a2a)] - **doc**: clean up Windows code snippet in `child_process.md` (reillylm) [#61422](nodejs/node#61422) - \[[`221648a687`](nodejs/node@221648a687)] - **esm**: update outdated FIXME comment in translators.js (Karan Mangtani) [#61715](nodejs/node#61715) - \[[`4484e14a31`](nodejs/node@4484e14a31)] - **events**: don't call resume after close (Сковорода Никита Андреевич) [#60548](nodejs/node#60548) - \[[`4cecbe1f53`](nodejs/node@4cecbe1f53)] - **fs**: add `throwIfNoEntry` option for fs.stat and fs.promises.stat (Juan José) [#61178](nodejs/node#61178) - \[[`2c94967684`](nodejs/node@2c94967684)] - **http**: remove redundant keepAliveTimeoutBuffer assignment (Efe) [#61743](nodejs/node#61743) - \[[`435f3dd8e4`](nodejs/node@435f3dd8e4)] - **http**: attach error handler to socket synchronously in onSocket (RajeshKumar11) [#61770](nodejs/node#61770) - \[[`ce0ebd853d`](nodejs/node@ce0ebd853d)] - **http**: fix keep-alive socket reuse race in requestOnFinish (Martin Slota) [#61710](nodejs/node#61710) - \[[`8103a78b6a`](nodejs/node@8103a78b6a)] - **http2**: add strictSingleValueFields option to relax header validation (Tim Perry) [#59917](nodejs/node#59917) - \[[`b0a79b10f0`](nodejs/node@b0a79b10f0)] - **(SEMVER-MINOR)** **http2**: add http1Options for HTTP/1 fallback configuration (Amol Yadav) [#61713](nodejs/node#61713) - \[[`c589b6b23c`](nodejs/node@c589b6b23c)] - **http2**: fix FileHandle leak in respondWithFile (sangwook) [#61707](nodejs/node#61707) - \[[`df477202ae`](nodejs/node@df477202ae)] - **lib**: reduce cycles in esm loader and load it in snapshot (Joyee Cheung) [#61769](nodejs/node#61769) - \[[`deda50a819`](nodejs/node@deda50a819)] - **lib**: remove top-level getOptionValue() calls in lib/internal/modules (Joyee Cheung) [#61769](nodejs/node#61769) - \[[`b1c1ddff79`](nodejs/node@b1c1ddff79)] - **lib**: optimize styleText when validateStream is false (Rafael Gonzaga) [#61792](nodejs/node#61792) - \[[`df334f7fa0`](nodejs/node@df334f7fa0)] - **meta**: use SCCACHE\_GHA\_ENABLED for shared build workflows (René) [#61640](nodejs/node#61640) - \[[`e1b2cd605f`](nodejs/node@e1b2cd605f)] - **meta**: bump cachix/install-nix-action from 31.9.0 to 31.9.1 (dependabot\[bot]) [#61910](nodejs/node#61910) - \[[`24b858547a`](nodejs/node@24b858547a)] - **module**: fix extensionless entry with explicit type=commonjs (Yuya Inoue) [#61600](nodejs/node#61600) - \[[`4f2f8006bd`](nodejs/node@4f2f8006bd)] - **repl**: fix FileHandle leak in history initialization (sangwook) [#61706](nodejs/node#61706) - \[[`2d874dfb8e`](nodejs/node@2d874dfb8e)] - **(SEMVER-MINOR)** **sea**: support ESM entry point in SEA (Joyee Cheung) [#61813](nodejs/node#61813) - \[[`ee59127664`](nodejs/node@ee59127664)] - **sqlite**: mark as release candidate (Matteo Collina) [#61262](nodejs/node#61262) - \[[`f14ff14473`](nodejs/node@f14ff14473)] - **src**: remove unnecessary `c_str()` conversions in diagnostic messages (Anna Henningsen) [#61786](nodejs/node#61786) - \[[`26a09e541d`](nodejs/node@26a09e541d)] - **src**: use bool literals in TraceEnvVarOptions (Tobias Nießen) [#61425](nodejs/node#61425) - \[[`62b0758c47`](nodejs/node@62b0758c47)] - **src**: fix `--build-sea` default executable path (Alex Schwartz) [#61708](nodejs/node#61708) - \[[`b5724921b1`](nodejs/node@b5724921b1)] - **src**: track allocations made by zstd streams (Anna Henningsen) [#61717](nodejs/node#61717) - \[[`3d1d1523a5`](nodejs/node@3d1d1523a5)] - **src**: do not store compression methods on Brotli classes (Anna Henningsen) [#61717](nodejs/node#61717) - \[[`b2915cda77`](nodejs/node@b2915cda77)] - **src**: extract zlib allocation tracking into its own class (Anna Henningsen) [#61717](nodejs/node#61717) - \[[`3032a7e3c6`](nodejs/node@3032a7e3c6)] - **src**: release memory for zstd contexts in `Close()` (Anna Henningsen) [#61717](nodejs/node#61717) - \[[`bc2287db74`](nodejs/node@bc2287db74)] - **src**: add more checks and clarify docs for external references (Joyee Cheung) [#61719](nodejs/node#61719) - \[[`5daf282e33`](nodejs/node@5daf282e33)] - **src**: fix cjs\_lexer external reference registration (Joyee Cheung) [#61718](nodejs/node#61718) - \[[`fb2db5f947`](nodejs/node@fb2db5f947)] - **src**: support import() and import.meta in embedder-run modules (Joyee Cheung) [#61654](nodejs/node#61654) - \[[`e146591002`](nodejs/node@e146591002)] - **stream**: fix decoded fromList chunk boundary check (Thomas Watson) [#61884](nodejs/node#61884) - \[[`065200a5f0`](nodejs/node@065200a5f0)] - **stream**: add fast paths for webstreams read and pipeTo (Matteo Collina) [#61807](nodejs/node#61807) - \[[`608736e19e`](nodejs/node@608736e19e)] - **(SEMVER-MINOR)** **stream**: rename `Duplex.toWeb()` type option to `readableType` (René) [#61632](nodejs/node#61632) - \[[`51587d684d`](nodejs/node@51587d684d)] - **test**: fix typos in test files (Daijiro Wachi) [#61408](nodejs/node#61408) - \[[`17b2361360`](nodejs/node@17b2361360)] - **test**: allow filtering async internal frames in assertSnapshot (Joyee Cheung) [#61769](nodejs/node#61769) - \[[`3f6a5f5f7f`](nodejs/node@3f6a5f5f7f)] - **test**: unify assertSnapshot stacktrace transform (Chengzhong Wu) [#61665](nodejs/node#61665) - \[[`c8dac320de`](nodejs/node@c8dac320de)] - **test**: check stability block position in API markdown (René) [#58590](nodejs/node#58590) - \[[`6809ef8d04`](nodejs/node@6809ef8d04)] - **test**: adapt buffer test for v8 sandbox (Shelley Vohr) [#61772](nodejs/node#61772) - \[[`60f5771a74`](nodejs/node@60f5771a74)] - **test**: update FileAPI tests from WPT (Ms2ger) [#61750](nodejs/node#61750) - \[[`d2fef4a31a`](nodejs/node@d2fef4a31a)] - **test**: update WPT for WebCryptoAPI to [`7cbe7e8`](nodejs/node@7cbe7e8ed9) (Node.js GitHub Bot) [#61729](nodejs/node#61729) - \[[`d7a87f14da`](nodejs/node@d7a87f14da)] - **test**: update WPT for url to [`efb889e`](nodejs/node@efb889eb4c) (Node.js GitHub Bot) [#61728](nodejs/node#61728) - \[[`b6ae1fc4b8`](nodejs/node@b6ae1fc4b8)] - **test**: split test-embedding.js and run tests in parallel (Joyee Cheung) [#61571](nodejs/node#61571) - \[[`a43375999f`](nodejs/node@a43375999f)] - **(SEMVER-MINOR)** **test\_runner**: show interrupted test on SIGINT (Matteo Collina) [#61676](nodejs/node#61676) - \[[`1c02aa09b0`](nodejs/node@1c02aa09b0)] - **test\_runner**: fix suite rerun (Moshe Atlow) [#61775](nodejs/node#61775) - \[[`47821ec609`](nodejs/node@47821ec609)] - **tools**: switch to ARM runners on GHA jobs (Antoine du Hamel) [#61903](nodejs/node#61903) - \[[`1630a56370`](nodejs/node@1630a56370)] - **tools**: avoid building twice in coverage jobs (Antoine du Hamel) [#61899](nodejs/node#61899) - \[[`89318b0a02`](nodejs/node@89318b0a02)] - **tools**: fix auto-start-ci (Antoine du Hamel) [#61900](nodejs/node#61900) - \[[`ee107f5e84`](nodejs/node@ee107f5e84)] - **tools**: do not checkout repo in `auto-start-ci.yml` (Antoine du Hamel) [#61874](nodejs/node#61874) - \[[`c2de1fa619`](nodejs/node@c2de1fa619)] - **tools**: cache V8 build on test-shared workflow (Antoine du Hamel) [#61860](nodejs/node#61860) - \[[`111c77ec94`](nodejs/node@111c77ec94)] - **tools**: automate updates for test/fixtures/test426 (Rich Trott) [#60978](nodejs/node#60978) - \[[`ea8886f7d5`](nodejs/node@ea8886f7d5)] - **tools**: use ubuntu-slim runner in GHA (Antoine du Hamel) [#61759](nodejs/node#61759) - \[[`9db82ba786`](nodejs/node@9db82ba786)] - **tools**: bump unist-util-visit in /tools/doc in the doc group (dependabot\[bot]) [#61646](nodejs/node#61646) - \[[`c8e58c56b9`](nodejs/node@c8e58c56b9)] - **tools**: bump the eslint group in /tools/eslint with 6 updates (dependabot\[bot]) [#61628](nodejs/node#61628) - \[[`2518ec77e8`](nodejs/node@2518ec77e8)] - **tools**: use ubuntu-slim runner in GHA (Antoine du Hamel) [#61734](nodejs/node#61734) - \[[`c5ad2beba3`](nodejs/node@c5ad2beba3)] - **tools**: fix small inconsistencies in JSON doc output (Antoine du Hamel) [#61757](nodejs/node#61757) - \[[`a9f90bee0a`](nodejs/node@a9f90bee0a)] - **tools**: use ubuntu-latest runner in `notify-on-push` workflow (Antoine du Hamel) [#61742](nodejs/node#61742) - \[[`30e38182d9`](nodejs/node@30e38182d9)] - **watch**: get flags from execArgv (Efe) [#61779](nodejs/node#61779) - \[[`da1a08a3a5`](nodejs/node@da1a08a3a5)] - **worker**: eliminate race condition in process.cwd() (giulioAZ) [#61664](nodejs/node#61664) - \[[`dfac82a235`](nodejs/node@dfac82a235)] - **zlib**: add support for brotli compression dictionary (Andy Weiss) [#61763](nodejs/node#61763) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

nodejs-github-bot added needs-ci PRs that need a full CI run. stream Issues and PRs related to the stream subsystem. labels Feb 19, 2026

watson force-pushed the fix-readable-stream-bug branch from 8a962b7 to 5ef134f Compare February 19, 2026 10:30

watson changed the title ~~fix(stream): fix decoded fromList chunk boundary check~~ stream: fix decoded fromList chunk boundary check Feb 19, 2026

ronag approved these changes Feb 19, 2026

View reviewed changes

fix lint

2984f13

BridgeAR approved these changes Feb 19, 2026

View reviewed changes

BridgeAR added request-ci Add this label to start a Jenkins CI on a PR. author ready PRs that have at least one approval, no pending requests for changes, and a CI started. labels Feb 19, 2026

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Feb 19, 2026

IlyasShabi approved these changes Feb 19, 2026

View reviewed changes

gurgunday approved these changes Feb 19, 2026

View reviewed changes

lpinca approved these changes Feb 19, 2026

View reviewed changes

mcollina approved these changes Feb 19, 2026

View reviewed changes

mcollina added request-ci Add this label to start a Jenkins CI on a PR. commit-queue Add this label to land a pull request using GitHub Actions. and removed request-ci Add this label to start a Jenkins CI on a PR. labels Feb 19, 2026

JungMinu approved these changes Feb 20, 2026

View reviewed changes

cjihrig approved these changes Feb 20, 2026

View reviewed changes

Ethan-Arrowood approved these changes Feb 20, 2026

View reviewed changes

nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels Feb 21, 2026

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Feb 22, 2026

nodejs-github-bot merged commit d10104b into nodejs:main Feb 22, 2026
86 checks passed

github-actions bot mentioned this pull request Feb 22, 2026

2026-02-24, Version 25.7.0 (Current) #61922

Merged

watson deleted the fix-readable-stream-bug branch February 22, 2026 06:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

stream: fix decoded fromList chunk boundary check#61884

stream: fix decoded fromList chunk boundary check#61884
nodejs-github-bot merged 2 commits intonodejs:mainfrom
watson:fix-readable-stream-bug

watson commented Feb 19, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Feb 19, 2026

Uh oh!

nodejs-github-bot commented Feb 19, 2026

Uh oh!

codecov bot commented Feb 19, 2026 •

edited

Loading

Uh oh!

mcollina left a comment

Uh oh!

nodejs-github-bot commented Feb 21, 2026

[detached HEAD 403f5bd46a] fix lint
Author: Thomas Watson <w@tson.dk>
Date: Thu Feb 19 11:43:24 2026 +0100
1 file changed, 1 insertion(+)
Successfully rebased and updated refs/heads/main.

Uh oh!

Uh oh!

nodejs-github-bot commented Feb 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

Uh oh!

Conversation

watson commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Feb 19, 2026

Uh oh!

nodejs-github-bot commented Feb 19, 2026

Uh oh!

codecov bot commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

nodejs-github-bot commented Feb 21, 2026

[detached HEAD 403f5bd46a] fix lint Author: Thomas Watson <w@tson.dk> Date: Thu Feb 19 11:43:24 2026 +0100 1 file changed, 1 insertion(+) Successfully rebased and updated refs/heads/main.

Uh oh!

Uh oh!

nodejs-github-bot commented Feb 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

watson commented Feb 19, 2026 •

edited

Loading

codecov bot commented Feb 19, 2026 •

edited

Loading

[detached HEAD 403f5bd46a] fix lint
Author: Thomas Watson <w@tson.dk>
Date: Thu Feb 19 11:43:24 2026 +0100
1 file changed, 1 insertion(+)
Successfully rebased and updated refs/heads/main.